chore: standardize placeholder hostnames on imagile.dev

[kolatts]

Problem

The repo used five competing conventions for placeholder hostnames:

Convention	Occurrences
example.com	174
company.com	57
mycompany	12
your-company	8
myteam	3

company.com, mycompany.com, and your-company.com are real domains registered to third parties. pncli sends auth headers to whatever baseUrl is configured, so a user who copy-pasted a documented value would ship their PAT to someone else's host.

Having no written convention is also how two real internal hostnames reached a public test fixture unnoticed.

Changes

• Self-hosted services → <service>.imagile.dev. That domain has no wildcard DNS, so a copy-pasted config fails at DNS resolution before any credential leaves the machine. .dev is HSTS-preloaded as a second layer.
• Vendor-hosted SaaS keeps the vendor domain with imagile as tenant: imagile.service-now.com, imagile.sdelements.com.
• Checkmarx IAM realm placeholder mycompany → imagile.
• CLAUDE.md gains a Placeholder Hostnames section plus a line in the Testing Rule, including the standing constraint never to add wildcard DNS to imagile.dev.
• CHANGELOG.md: the 150 commit links were remapped onto current SHAs.

Deliberately unchanged

• src/lib/git-context.test.ts keeps other.example.com — those tests assert behavior against a foreign host, so the domain has to stay visibly different. Using imagile.dev on both sides would defeat the assertion.
• Email placeholders keep you@example.com (RFC 2606). This rule covers service hostnames, not mailboxes.
• NOTICE is unchanged.
• No site/src/ files are touched, so the screenshot requirement does not apply.

Verification

npm run typecheck   ✓
npm run lint        ✓
npm test            ✓  404/404
npm run build       ✓

Closes #294

🤖 Generated with Claude Code

[claude]

PR Review: chore: standardize placeholder hostnames on imagile.dev

• Clean up previous Claude comments
• Read PR diff and changed files
• Review CLAUDE.md updates
• Review test file changes
• Review skills documentation changes
• Check for missed/incorrect placeholder instances
• Fix email placeholder violations
• Submit formal review

Found: Email placeholder rule in CLAUDE.md is violated in 3 places by this same PR. Fixing before approving.

View job run

[claude]

Good change overall — the security rationale is solid and the CLAUDE.md documentation is thorough.

One self-contradiction caught and fixed in commit 8554c56: the PR adds an email exception rule ("email placeholders keep you@example.com") but then violated it in three spots:

• src/lib/config.test.ts — user@imagile.dev in the user.email fixture → user@example.com
• pncli-scaffold-prompt.md — you@imagile.dev in the Jira email field example → you@example.com
• infra/README.md — you@imagile.dev in the curl smoke test email field → you@example.com

Two borderline cases left as-is (not mailbox placeholders):

• user@imagile.dev as Contrast Security username in http.test.ts — this is a service credential, not an address field
• bob@imagile.dev as ADO AssignedTo value in ado/helpers.test.ts — same, user identity in a work-item context

The jenkins.myteam.imagile.dev in skills/pncli/jenkins.md is intentional — it illustrates the per-team subdomain pattern, and the safe domain (imagile.dev, no wildcard DNS) applies.

CHANGELOG.md SHA remapping is consistent with the PR description.